Hacking JPEG from pc as DSi background

[klopfdreh]

Hello everyone,

I tried to set a background picture on my dsi. I figured out that they have to be 640 x 480 in resolution, but thats what anyone knows. So I tried to find out a little bit more about that images taken by the dsi cam. I found out that there are exif metadata, that are containg several information who created the image and something what is realy important - the thumbnail that is beeing displayed on the dsi.

So I tested a little bit around and took two pictures with my cam. After that I modified one of that pictures and placed a nice wallpaper in one of it. The next step, I copied the complete metadata of the ds picture and placed it into the modified, than I created a new thumbnail. The only difference now is that in my modified picture there is no resolution unit property, that is set to value 2. (centimeter) - everything else is exactly the same!

I don't know how to add only one property to the exif metadata, thats my problem for now!

So I want to put my own background image into the dsi. My question: Is there any known way to do so? I saw the video of acekard2i and they displayed the gbatemp logo - so there has to be one way...

 

[houseonfire]

I've been attempting to do the same thing for a couple days. The procedure on how to do this would be helpful.

 

[CrimsoniteX]

In my testing, I am fairly certain that the DSi keeps track of what pictures are supposed to be on the system, and stores that info in the photo channel. Thus when it is altered, the DSi knows it, and doesn't display the picture. They are probably doing this on purpose so people do not try buffer overflows with jpeg files (which is a known exploitable format).

Also if you look at the encoding on the jpeg, Nintendo has some info in there as well. That may have something to do with it.

 

[wchill]

Can we see some information proving this? And if that's true, then how did Yasu perform his DSi exploit?

 

[klopfdreh]

I took two pictures with my cam and I forgot to say, that I modified one which was taken by the cam - so one picture that is registered in the nintendo dsi system. For all of you, who want to see the metadata of the images taken by nintendo - try XnView - that program shows meta information like EXIF and IPTC.

Mh, may they also store the size of the image in an internal db, so that you can't modify it, resulting in other filesize.

 

[Carbonator]

Are the pictures registered within the DSi system, or on the SD card? I guess this could be tested by swapping the card among different systems and seeing if the pictures appear.

I could see Nintendo storing a checksum as well as file size in their collection.

Lastly, their security with the JPEGs seems pretty pointless, since you can still give it AACs. Presumably JPEGs and many other image formats render in the DSi browser as well.

 

[Kingfield]

AACs would be a bit harder to exploit with I think,

 

[klopfdreh]

The pictures can be stored on the system and on the flash card as well. I found out that only those which are stored at the system memory are beeing displayed at the startup - correct me if I'm wrong. Well, after I modified the picture there was only a question mark - no thumbnail.

 

[CrimsoniteX]

AACs would be a bit harder to exploit with I think,

The only known buffer overflow I have ever seen with an AAC file was one with Winamp, but it was because Winamp made a HUGE mistake in their coding. I'm pretty sure Nintendo looked into that and made sure it wouldn't happen again... but then again, you never know.

 

[DSi2010]

Mh, may they also store the size of the image in an internal db, so that you can't modify it, resulting in other filesize.

Sorry for posting in this dead topic, but I really would make clear, that there is some checksum or something and NOT only the filesize, because I made a second JPG with the same EXIF-Data (jhead -te ) and even with the same filesize. (this was very hard, cause I had to do some pixeling to reach the same size)
Does somebody knows how to copy JPEGs onto the DSi today???

 

[rockstar99]

Make it take a picture of your picture XD

lol thats what I do

 

[DSi2010]

But this is not a good method at all.
Look at some Hatena Flipnotes. Some of them really look like someone just used an image to make them. The Flipnotes are not really hackable because there is a 128 Byte checksum on each ppm file...

Maybe someone knows how to edit Flipnotes?

 

[Demonbart]

Are the pictures registered within the DSi system, or on the SD card? I guess this could be tested by swapping the card among different systems and seeing if the pictures appear.

I could see Nintendo storing a checksum as well as file size in their collection.

Lastly, their security with the JPEGs seems pretty pointless, since you can still give it AACs. Presumably JPEGs and many other image formats render in the DSi browser as well.

If the browser can load JPEGs couldn't someone post a jpeg with the exploit hidden in it, then load the page with the browser and use it to hack the DSi in that way? Mind you, I haven't really looked into this and I'm not OMG I FOUND THE WAY TO HAX TAH DSI! it's just an idea we might be able to use.

 

[DSi2010]

Uh, guys...
I want just the JPEG from the PC, not any exploit, look at the topic-title

//edit: okay, hatena flipnote IS not JPEG, but something what is about "pictures => dsi" xD

 

[GameDragon]

Last I checked, you can't take images from a PC and put it on a DSi. Not even from an SD card.

 

[markvn]

I already tried this many times, I also can't get it work....

 

[DSi2010]

yes but there MUST be a way. Like I said, only the EXIF-Data isn't enough. But I'm not really sure if there is a checksum or something. Maybe we just have to edit some taken photos with the hex-editor, but don't ask me, I don't have any idea how the structure of JPEG-Data is...

 

[markvn]

yes but there MUST be a way. Like I said, only the EXIF-Data isn't enough. But I'm not really sure if there is a checksum or something. Maybe we just have to edit some taken photos with the hex-editor, but don't ask me, I don't have any idea how the structure of JPEG-Data is...

Well, I also think so...
But who can see if something is special to a jpeg or just normal?
I mean, Nintie has to put something special inside.

 

[Rydian]

The pit.bin file the DSi creates when first using an SD card to store images... I took just one image, and that bin file is mostly empty.

00000000 - 30 54 49 50 30 30 5F 31 B8 0B 01 00 01 00 01 00
00000010 - 00 00 00 00 3F 1A 18 00 1F 49 15 13 00 00 00 00
And the rest is 0's, down through 0000BB90.

Upon taking another picture, it was this.

00000000 - 30 54 49 50 30 30 5F 31 B8 0B 01 00 01 00 02 00
00000010 - 00 00 00 00 C0 8C 18 00 1F 49 15 13 00 00 00 00
00000020 - 00 00 00 00 03 00 00 00 19 4B 15 13 00 00 00 00
All the rest 0's like before.

I edited the file (changing 4B in the third row to 4F) and upon starting the photo channel the DSi tells me the data-management (they used a hyphen) file is corrupt and that a new one would be made. That took only a second, and both images I had taken earlier were still there...

So you could try corrupting the file and seeing if it'll take in any new images after that?

 

[Sumea]

Seems like a lot of work for one JPG

Good thing I have my figurines in nice row so when I get DSi I can shoot good photo of that lovely bunch and be done with it.

(If you ask WHAT lovely bunch, refer to this image, at moment there is no new photo but now all of them sit on same wooden self - what is nice)